English Français العربية

io.github.eltociear/contract-guard-mcp

Official registry Finance and payments

EVM contract/token risk check + ERC20 approval (proxy, EIP-7702, unlimited-allowance). Zero deps.

Source code Documentation

What can you do with io.github.eltociear/contract-guard-mcp?

  • check_contract(address, chain) — is-contract/EOA, EIP-7702, proxy, ERC20 metadata, risk score
  • check_approval(token, owner, spender, chain) — ERC20 allowance audit; flags unlimited approvals (the #1 drain vector)

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

OCI package ghcr.io/eltociear/contract-guard-mcp:mcp-1.1.0
Claude Code 
claude mcp add contract-guard-mcp -- docker run -i --rm ghcr.io/eltociear/contract-guard-mcp:mcp-1.1.0
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "contract-guard-mcp": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/eltociear/contract-guard-mcp:mcp-1.1.0"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. contract-guard-mcp
  2. Run
  3. Tools
  4. Free MCP vs paid x402
  5. Professional audit services

contract-guard-mcp

MCP server for a pre-interaction risk check on any EVM contract/token — what an agent needs before it approves, swaps, or trusts an address.

Tool: check_contract(address, chain="base") →

  • is-contract vs EOA / self-destructed
  • EIP-7702 delegated-EOA detection
  • upgradeable proxy detection (EIP-1967 + legacy zeppelinos)
  • ERC20 metadata (name / symbol / decimals / totalSupply)
  • risk score + actionable flags

Chains: Base, Ethereum. Pure public JSON-RPC, zero dependencies, no signing.

Also available as a pay-per-call x402 HTTP endpoint: https://eltociear-contract-guard.hf.space (POST /check, $0.005 USDC on Base).

Run

docker run -i --rm ghcr.io/eltociear/contract-guard-mcp:mcp-latest
# or
python3 server.py

MIT licensed.

Tools

  • check_contract(address, chain) — is-contract/EOA, EIP-7702, proxy, ERC20 metadata, risk score
  • check_approval(token, owner, spender, chain) — ERC20 allowance audit; flags unlimited approvals (the #1 drain vector)

Free MCP vs paid x402

This MCP server is free (run it locally / via your client). For server-side, batch, or no-install use, the same engine is a pay-per-call x402 HTTP API — POST https://eltociear-contract-guard.hf.space/check ($0.005 USDC on Base, no signup). Your agent's wallet pays per call.

Professional audit services

Maintained by the same author — paid services on Polar (Stripe checkout):

Full catalog: polar.sh/eltociear

Also live: clean-read ($0.005 / call)

Same operator, same x402 rails: clean-read turns any URL into clean Markdown for AI agents — fetches the page, strips nav/ads/boilerplate (trafilatura), returns the main content with title and word count. POST https://eltociear-skill-audit.hf.space/read — $0.005 USDC on Base, no signup.

Frequently asked questions

What is io.github.eltociear/contract-guard-mcp?

EVM contract/token risk check + ERC20 approval (proxy, EIP-7702, unlimited-allowance). Zero deps.

How do I install io.github.eltociear/contract-guard-mcp?

It runs on your machine. In Claude Code: claude mcp add contract-guard-mcp -- docker run -i --rm ghcr.io/eltociear/contract-guard-mcp:mcp-1.1.0. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.eltociear/contract-guard-mcp need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.eltociear/contract-guard-mcp open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.eltociear/contract-guard-mcp?

It is published by eltociear. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.